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PATENT 

IN THE uni:th> states patent and trademark office 

In re application of: ) 

) 

Jaggeret al ) Group Art Unit: 2143 

) 

Appli cation No. 10/072,708 ) Examiner: Bilgranu, Asghax H. 

) 

Filed: Februarv 5. 2002 ) Date; March 8, 2007 

) 

For: SPAM REPORT GENERATION SYSTEM ) 
AND METHOD ) 
) 

) 

Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 

ATTENTION: Board of Patent Appeals and Interferences 

SUBS I ITU I E APPEAL BRI KF (37 C.F.R. § 41.37) 

This brief is in furtherance of the Notice of Appeal filed August 3, 2006, a substitute for the 
Appeal Brief filed December li, 2006, and in response to the Notification of Non-Conipiiant 
Appeal Brief mailed on February 8, 2007 (see attached). While appdiant disagrees with the 
Examiner as to whether the alleged deficiencies exist in the original Appeal Brief, a Substitute 
Appeal Brief with appropriate edits is nevertheless submitted to expedite prosecution. 

The fees required under § 1.17, and any required petition for extension of time for tiling this 
brief and fees therefor, are dealt with in the accompanying rRANSMlTTAL OF APPEAL 
BRIEF. 

■f iiis brief coniains these items under liie following headings, and in the order set forth below (37 
Cf.R. §41.37(c)(i))-. 



I RE.4L PARTY IN INTEREST 

II RELATED APPEALS AND INTERFERENCES 



in STATUS OF CLAIMS 

IV STATUS OF AMENDMENTS 

V SUMM ARY OF CLAIMED SUBJECT MATTER 

VI GROt 'NDS OF REiECTlON TO BE REVIEWED ON APPEAL 
Vn ARGIMF.NT 

\'U\ CLAi\!S XPPFNDIX 

IX hyiDi:\(l: APPLNDLV 

X RELAI ED PROCEEDLNG AJ'PENDIX 



The final page of this brief bears the practitioner's signature. 



-3 - 

I REAL PARTY IN INTEREST (37 C.F.R. § 4i.37(c)(l)(i)) 

The reai patty in interest in this appeai is McAfee, Inc. 
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II RELATED APPEALS AND INTERFERENCES (37 C.F,R. § 41.37(c) 

With respect to other prior or pending appeals, interferences, or related Judicial proceedings that 
will directly affect, or be directly affected by, or have a bearing on the Board's decision in the 
pending appeal, there are no other such appeals, interferences, or related judicial proceedings. 

A Related Proceedings Appendix is appended hereto. 
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III STATUS OF CLAIMS (37 C.F.R, § 4137(c) (l)(iU» 

A. TOTAL NUMBER OF CLAIMS IN APPLICATION 
Claims in the application are: 1-8, and iO-3 1 

B. STATUS OF ALL THE CLAIMS IN APPLICATION 

1 . ClaitBS withdrawn from consideration: None 

2. Claims pending: 1-8, and 10-31 

3. Clairris allowed: None 

4. Claims rejected: 1-8, and 10-31 

5. Claims cancelled: 9 

C. CLAIMS ON APPEAL 

The claims on appeal are; 1-8, and 10-31 

See additional status information in the Appendix of Claims. 
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IV STATUS OF AMENDMENTS (37 C.F.R. § 41.37(cKl)(iv)) 

As to the status of any amendment fiied subsequent to finai rejection, there are no such 
amendments after finai. 
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V SUMMARY OF CLAIMED SU BJECT MATTER (37 C.F.R, § 41.37(c)(lKv)) 

\\\{h R-spttt to <i siimman' of Claim U as shown m Figuie 4 et a! a method is pro\ided for 
tit-ncK^niy a icpvirt on an unsolicited ciectronic messas>c in use an eiectronic mail messv^gc is 
received {eg sec item So o{ Figiue 4 etc ) Fu'thci u is detcinuned Nshetiiei the ekvijonic 
inest>age is an LjnM>liCited inessage {eg see itcvi K2 of 1 iguie 4 etc >, and \i the nie.ss.^ijc ts m 
unsohciteti message, the message !s e\amnied ro identifv a network address leiatmg to Uie 
message (eg see item 84 of t-igtire 4, etc) in addition, an authont\ iiostiiig tiie nctN\ork. 
address is identifsed (e.g. see item 86 of Figure 4, etc.), and a report containing the identified 
network address and hosting autJiority is genemted (e.g. see item 88 of Figure 4, etc). 
Moreover, identifying tiie hosting autiiority comprises identifying an owner of a network 
domain. See, for example, page 4, line 2 - page 5, line 14 et al. 

With respect to a summary of Claim 2, as shown in Figure 4 et al,, the generated report is 
transmitted to the identified hosting authority (e.g. see item 1.00 of Figure 4, etc). See, for 
exarnpie, page 4, lines 6-8; mid page 4, lines 10-12 et al. 

With respect to a summary of Claim 4, identifying a URL comprises comparing text within the 
electronic message to a database of words to identity the UR.1... See, for example, page 5, lines 3- 
4; page 1 1, lines 1 -4; and page 1 1 , iine 1 9 ■■■ page 1 2, line 2 et al. 

With respect to a summary of Claim 5, the identified URL is compared to a database of 
legitimate URLs. See, for exainple, page 5, lines 5-6; and page 12, lines 9-15 et al . 

With respect to a summar>' of Claim KX identifying the hosting authority comprises identifying 
an Internet service provider. See, for example, page 12, lines 9-10; page 12, lines 13-14; and 
page 14, lines l-7etal. 

With respect to a summar>' of Claim 1 1, tlie report is ti'ajismitted to a central managed seivice 
provider configut^d to forward the report to the identified hosting authority. See, for example, 
page 17, lines 13-15 et al. 
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Wjth respect to a sunimar>' of Claim 12, at least temporarily saving the report and transmitting 
the report to the identifjed hosttog authority at the end of a specified period. See, for example, 
page 17, lines 1 5-17 et a!. 

With respect to a summaty of Claim 13, as shown in Figure 2 et al., a system is provided for 
generating a report on an unsoHcited electroriic message A detector (e.g. see item 44 of Figure 
2, etc.) is included tiiat is operable to detect a network address within an electronic message 
identified as an unsolicited message. Further, a host identifier (e.g. see item 48 of Figure 2, etc) 
is included that is operable to identify an authority hosting the network address. In addition, a 
report generator (e.g. see item 50 of Figure 2, etc.) is included that is operable to generate a 
report containing the identified network address and hosting authority. A storage medium (e.g. 
see item 46 of .Figure 2, etc.) is included that is configured to at least temporarily store the 
identitled network address and hosting authority. Moreover, identifying the hosting authority 
comprises identifying an owner of a network domain. See, for example, page 4, line 2 - page 5, 
line 14 etal. 

With respect to a summary' of Claim 16, the hosting autiiority is an Internet service provider. See, 
for example, page 12, lines 9-1 1 et al. 

With respect to a summary of Claim 1 8, as shown in Figure 4 et ai., the processor is configured 
to tJ-ansmit the report to the identified hosting autiiority (e.g. see item 100 of Figure 4, etc). See, 
for example, page 4, lines 6-8; and page 4, lines 10-12 et al. 

With respect to a summary of Claim 19, the processor is configured to transmit the report to a 
central managed sen^ice provider. See, for example, page 17, lines 13-15 et al. 

With respect to a summary of Claim 20, a database containing search terms is used to identify 
the network address within text of the electronic message. See, for example, page II, hne 19 -■ 
page 12, line 2 et al. 

With respect to a summary of Claim 21, a database contains a list of trusted network addresses. 
See, for exaitnple, page 12, lines 3-5 et ai. 
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With respect to a summaury of Claim 22, as shown in FiguT-e 4 et al., a computer product is 
provided for generating a report on an unsolicited eiectrotiic raessajre ('ode is jncUtded that 
receives an electronic mail message i^e u see item 80 of Figure 4, etc ) I urther, tht- code is 
inciuded that dt'tcfmiues uhether the elccuontc n>e<Nsage is an nnsnliciicJ n^essai/c (o g see item 
S2 of ^liiufe 4 fic > hi adduion, code is included that exan^jnes tke niess<iyc lo idcnuf\ <i 
nehvork .idtiress relating to the me^sasie if the message js an unsolicited iiie<;e;age (eg see stem 
84 of Irigurc 4, etc.). Furthermore, code is inciuded that identifies an authority- hosting the 
network address (e.g. see item 86 of Figure 4, etc.), and that generates a report containing the 
identified network address (e.g. see item 88 of Figure 4, etc.). .Also included is a computer 
readable medium that stores said computer codes. Moreover, ideiitifying the hosting authority 
comprises identifying an owner of a network domain. See, for example, page 4, line 2 ~ page 5, 
line 14 etal. 

With respect to a sunnnary of C'laim 24, as shown in Figure 4 et a!., code transmits the generated 
report to the identified hosting authoiity (e.g. see item 100 of Figure 4, etc.). See, for example, 
page 4, lines 6-8; and page 4, lines 10-12 et al. 

With respect to a summary of Claim 25, code compares text within the electronic message to a 
database of words to locate the network address within the text. See, for example, page 1 1 , lines 
1 -4; and page 11 , line 1 9 - page 1 2, line 2 et al. 

With respect to a sitinraary of Claim 26, code coinpares the identiOed network address with 
trusted network addresses, See, for example, page 1 1 , line 1 9 ■■■ page 1 2, hne 5 et al , 

With respect to a summary of Claim 29, the report is utilized to generate an electronic mail 
message to be sent to the identified organizadon. See, tor example, page 12, line 18 - page 13, 
line 21 etal. 

"With respect to a summary' of Claim 30, identifying the URL ftJrther comprises examining text 
surrounding the URL to detemiine a likelihood that the URL is an address of a web site 
associated with unsolicited messages. See, for example, page 11, lines 13-15 etal. 
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With respect to a summai-y of Claim 3 1 , the report includes disclaimer infonnation and user 
definable text. See, for example, page 14, iines 1 5-16 et al. 

Of course, the above citations are merely examples of the above claim language and should not 
be construed as limiting in any marmer. 
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VI GROUNDS OF REJECTION TO BE REVIEWED ON APPEAL (37 C.F.R. § 
4I.37(c)(I)(vi)) 

Following, under each issue listed, is a concise statement setting forth the corresponding ground 
of rejection. 

Issue # 1: The Examiner has rejected Claims 1-8, and 10-31 under 35 IJ.S.C. 103(a) as being 
unpatentable over Aronson et al, (U.S. Patent No. 6,654,787 Bi ), in view of Leeds (U.S. Patem 
No. 6,393,465 B2). 
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VII ARGUMENT (37 C.F.R, § 41.37(c)(l)(vit» 

The claims of the groups noted below do not stand or tali together. In the present section, 
appell ant expl ains why the claims of each group are believed to be separately patentable. 

Issue. #..1..; 

The Examiner has rejected Claims 1-8, and 10-31 under 35 U.S.C. 103(a) as being unpatentable 
over Aronson et aK (U.S. Patent No. 6,654,787 B 1), in view of Leeds (U.S. Patent No. 6,393,465 
B2). 

Group 41: CJaims 1, 3, 7-8, 13-15, 17, mid 27-28 

With respect to such claims, the Examiner has relied on Col. 4, lines 5i-56, Col 5, lines 50-67, 
and the Abstract in Aronson along with Co!. 3, lines 54-67, and Co\. 4, lines 1-35 in L.eeds lo 
make a prior art showing of appellant's claimed 'identifying an autliority hosting the network 
address" (see the same or similar, but not necessaiiiy identical language in the foregoing claims). 

.Appellant respectfully asserts that the excerpts from l>eeds relied on by the Examiner only relate 
to a host computer associated with a sender of an electronic mail message (see Abstract and Col. 
4, lines 66-67, specifically). In addition, Leeds discloses that "if a message has purportedly been 
relayed through a machine named mail, fromnovvhere.com and the mail handling system has 

determined that such a machine does not actually exist, the contldence rating for the message 
should be increased." Qearly. determining a host computer/host name of a sender of e-mail or 
relay, as in Leeds, does not meet appellant's specific claim language, namely an "autliority 
hosting the network address" (emphasis added), as claimed by appellant. 

Further, appellant respectfully asserts that tlie exceipls from Aronson relied upon by the 
Examiner merely disclose that "[ojther contemplated rule handling filter modules will filter e- 
mail based on: (1) word or letter frequency analysis; (2) IP source frequency analy sis: (3) 
misspelling analysis (unwanted e-mail often contains misspelled words); (4) word or letter 
combination analysis; (5) technical or legal RFC822 header compliance; and (6) featjure 
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extraction. & analysis (e.g., based on phone numbers, URL's, addresses, etc.) " (emphasis added). 
Clearly, fihering e-mail based on IP source fi^quency and feature extraction & analysis fails to 
even suggest "identifying an authority hosting the, network^^^a^^ (emphasis added), as 
claimed by appellant. 

In dddition tfie f xanunei argued t\u\\ \i|oJn-5k*u d'^(.U>sed thai {he soukl' header Jat.i iiom 
mcoramg e-mai! addiess { \QiiO,s-\.. CvVi ) is anah^ied b\ the spam pjobes ' huahej the 
Examiner argued that '[t]he soujce header data mcludes. the ISl* (m tlii!> caisc 'aoi ) hostmg the 
spammer's network address (see col.4, lines 45-67).' Appellant disagrees and respectftilly 
asserts that the excerpt from Aronson simply discloses that "[a] spam probe is an e-mail address 
selected to make its way onto as many spam maiiing lists as possible." Aronson continues, 
teaching that "[i]t is also selected to appear high up on spammers' lists in order to receive spam 
mailings early in the mailing process" using an e-mail address such as " aardvarkcgj aol .com 
Clearly, the mere disclosure of using an e-nnii! address in a spasn probe, as in Aronson, 
completely fails to even suggest 'identrfying an <u)thority hosting the..nct^^^^ 
(emphasis added), as claimed by appellant- 
Still with respect to the present claims the Examiner has again relied on the Abstract; Col. 3, 
lines 54-67; and Col. 4, lines 1-35 in I.eeds to make a prior art showing of appellant's claimed 
"generating a report containing the identified network address and hosting authority" (see the 
same or similar, but not necessarily identical ian^iage in foregoing claims). 

AppeHant respectfuHy asserts that the only suggestion of a ''reporf' in the excerpts relied on by 
the E.xarniner merely relates to "'seed addresses [which] can alert an e-mail pfovider to potential 
mass mailings by reporting when mail is received for ghost or non-existent accoums." Cleariy, 
alerting an e-mail provider when an e-mail is received for a seed address, as in Leeds, fails to 
even suggest "generating a report containing the identified network address and hosdng 
M^orits^" (emphasis added), as claimed by appeHant, 

Further, tlie Examiner argued that "Leeds also describes the similar process of identifying the 
host name of the spammer's address (please see coi.4, lines 60-67 & col. 5, lines 1-45)." 
.Appellant disagrees and respectfully asserts that I-eeds simply discloses that '[tjhe fields for 
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"Rctinn Path 'Trom and "Repl>-To " arc hjghhghtcd &i> three ol the tloids which the piC!>eiit 
mventum v^ill pajse Aom the message headet As an example, [eeds teaches thai 'Ttoni 

48^>4l40>''rtnotneaL<.ldit.s^. com is bioken doun into a user jd <48941493) and a hostjname 
ftivn-ajcaiciddiess („!>m) t emphasis uidcd) ! ceds continuci disclosing that afirst !e\cl cbetk is 
justd] to detLtnitne ti iht a!kj;ed render idcntiiled In the Fiom oi Reph IjlUs aje 
\(ihd \joreo\ei I etds dischises that the t1ist lexel check iiKiud[e ] { \) scikiii^^. a message to 
die usei uientd'ieti b\ the I lom " Of "ilepK - 1 o fields and evirauiine tthetha the message can 
be &ucce!>i>tullv dch\eied, (2) U!>ing the L NIX " \\hois> command to determmc if a !>itc (oi hoi.t) 
by that name actually exists, (3) using the UNIX "fijnge[" command to identify if a user name 
exists at a verifiable host, (4) using the "yffy." command when connected to a sendmaii daemon 
to verify that a user exists at a particular site, and (5) using the UNLX " traceroute " command to 
make sure there is a valid route back to the specified host' (emphasis added). Clearly, 
performing a first level check including using whois, and traceroute to verify the host name from 
the "Frow." and "Reply-To:" fields, as in [.eeds, faiis to even suggest '-generating a report 
go^taintng the idenjy|iM ftMwMjj<^^.g^^ and ho-sting.iVu.thont^^^ (emphasis added), as claimed 
by appellant. 

Further, with respect to each of the present claims, the Examiner has relied on Col. 4, lines 60- 
67; Col. 5, lines 1-44; and Col. 6, lines 52-65 in l>eeds to make a prior art showing of appellant's 
claimed technique "wherein identifying the hosting authority comprises identifying an owner of 
a network domain" (see the same or similar, but not necessarily identical language in the 

fbregoing claims). 

.Appellant respectfully asserts that the excerpts from l..eeds relied upoji by the Examiner merely 
disclose '& first level check is to detemvine if the alleged sender identified by the "From:" or 
"Reply-To:" fields are valid' (emphasis added). In addition, Leeds discloses 'using the UNIX 
" whois " command to determine if a site for host) by that name actually exists ' (emphasis added). 
Cleariy, using whois to perform a first level check to ensure the host actually exists for the 
alleged sender in the "From:" or *'Reply-To:" fields, as in Leeds, fails to even suggest a 
technique "wherein identifying the hosting authority comprises identifying an owner of a 
.nMwork.domain" (emphasis added), as claimed by appellant. Appellant respectfully asserts that 
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merely ensuring that a host actually exists fails to even suggest "identifying an owner of a 
network domain," as claimed by appellant. 

To e^tabiisii a pi mm fm le case of obviousness, three basic ciiteria must be met First there must 
he soinc suggei,uon ot nunndtion, t'uher m the icfcienoes theinsei\cs nr jn ibc knou ledge 
geucK^lK .nailcibie \o one of oulniaiv skill m tlie ait tv> nuxlih t!iy ietett'iicc or \o <^on).\m\k. 
iefeience teaohins;^; Second theie must be a leasonable expectation of success Iruialiv tbt; pi mi 
art reference (or references when combined) must teach or suggest all the claim limitations. The 
teaching or suggestion to make the claimed combination and the reasotiable expectation of 
success must both be found in tJie prior art and not based on appellant's disclosure, in re 
Vaeck,947 F.2d 488, 20 USPQ2d 1438 (Fed.Cir.199l). 

Appellant respectfully asserts that at least the third element of the prima facie case of 
obviousness has not been met, since the prior art references, when combined, fail to teach or 
suggest Ml of the claim limitations, as noted above. 

Gnmp #2; Claims 2, J 8, a fid 24 

With respect to Claim 2 et al, the Examiner has relied on Col. 4, lines 36-67; Col. 5, lines 1-44; 
and Col. 8, lines 34-57 in Leeds to make a prior art showing of appellant's claimed "transmitting 
the generated report to the identified hosting authority " 

Appellant respectfully asserts that the only rnesition of any sort of report, in such excerpts from 
Leeds, is the teaching that 'addresses could be watched for incoming jonk e-mail and a 
notification from the authentication server could then be broadcast to users indicating that mail 
with the subject of "XYZ" is junk e-mail' (see, specitically. Col. 8, lines 47-50), Clearly, such 
notification sent to users does not meet appellant's claimed "transmitting the generated report to 
tiaeidM^fiedhostin^^ (emphasis added), as claimed by appellant. 

Again, appellant respectftiUy asserts that at least the third element of the prima facie case of 
obviousness has not beeti met, as noted above. 
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Gnmp ^3: Claim 4 

With respect to Claim 4, the Examiner has relied on Col, 4, lines 57-67; Coi, 5, Unes 1-8; and 
Col. 5, lines 50-67 in Aronson to make a prior art showing of appellant's claimed technique 
"wherein identifying a URL. comprises comparing text within the electronic message to a 

database of words to identify t!ie 1.01L>." 

After careful review of the excerpts relied on by the Exmniner, appellant notes that the only URL 
disclosed in. Aronson relates to filtering e-mail based on "feature extraction & analysis 
(e.g.,. . . URL's. . (see Co! . 5, lines 63-64). Bovvever, Aronson does not teach how such URL is 
identified, whereas appellant specifically claims "identifying a URL [by] comparing text within 
the electronic message to a database of words to identify the LFRL," as claimed. Appellant 
further notes that Aronson only teaches that spam may be filtered "based on a specific keyword 
searcii," and that therefore the keywords are used to identify spam . b«t not that a database of 
words is utilized to "identify the URL" (emphasis added), in the manner claimed by appellant 

Again, appellant respectfully asserts that at least the third element of the prmm facie case of 
obviousness has not been met, as noted above. 

Graup Claim 5(md 6 

With respect to Claim 5, the Examiner has relied on Col. 4, lines 57-67; Col. 5, lines 1-8; and 
C;ol, 5, lims 50-67 in Aronson to make a prior art showing of appellant's claimed "comparing the 

identified URL to a database of legitimate L^RLs." 

After careful review of the excerpts relied on by tlie Examiner, appellant notes that Aronson 
merely discloses that "[i]f the network address contained in the source header is identified as the 
network address of a known spammer, a njtje will be established to IMjterjILinconiing.^^ 
from this network address into the spam storage area 230" (Col. 4, lines 60-62 emphasis 
added). Further, Aronson discloses that "[rjules 210 based on keywords in the subject or body of 
spam e-mail may also be established" and '[f]or example, all e-mails containing the two words 
"sex" and "free" may be identifled.MspM» M^ (Col. 4, hnes 2-5 ~- emphasis added). In 
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additioii, Aronsoii discloses that 't^JtHer contemplated rule handling filter modules will filter e- 
mail based on: (1) word or letter frequency analysis; (2) IP Jjource fregueTjtcy analysis; (3) 
misspelling anaiysis (unwanted e-mail otl;en contaiits misspelled words); (4) word or letter 
combination analysis; (5) technical or legal RFC822 header conipiiance; and (6) feature 
extraction. & analysis (e.g., based on phone numbers, UKL's, addresses, etc.)" (Col. 5, lines 58- 
64 -- emphasis added). 

However, appellant respectfully asserts that Aronson's disclosure of filtering e-mail as spam 
based on keywords, the source address being identified as a known spammer, IP source 
frequency analysis, and feature extraction and analysis, simply fails to even suggest *\companiitg 
the identified URL to a database of le gitimate URLs" (emphasis added), as claimed by appellant. 
Clearly, filtering based on a feature extraction and analysis of a URL fails to suggest "comparing 
the identifieCUE-L to a database of legitimate U^^^ (emphasis added), as claimed by appellant. 

Again, appellant respectfully avsserts that at least the third element of the prima facie case of 
obviousness has not been met, as noted above. 

Group ii-5: Claim 10 

With respect to Claim 10, the Examiner has relied on Col. 3, lines 54-67; Col. 4, lines 1-23; Col. 
4, lines 1-23 and 60-67; and Col. 5, lines 1-44; in Leeds to make a prior art showing of 
appellant's claimed technique "wherein identifying the hosting authority comprises identifying 
an Internet service provider." 

Appellant respectfuny asserts that the excerpts from Leeds relied upon by the Examiner merely 
disclose that 'a first level check is to determine if the alleged sender identified by tlie " From :" or 
" Reply-To ;" fields are valid ' (emphasis added). In addition, Leeds discloses 'using the UNIX 
"whois" commmid to determine ^tasiteJo|Jiosi|)l!X.^^ (emphasis added). 

Clearly, using whois to perform a first level check to ensure the host actually exists for the 
alleged sender in the "From:" or "Reply-To:" fields, as in Leeds, fails to even suggest a 
technique "wherein idMfify.m.g the .hostin^..authority. comprises identifying an .lntern#...seTvice 
jgmvider" (emphasis added), as claimed by appellaiit. Appellant respectfolly asserts that merely 
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ensuring that a host acttially exists fails to specifically suggest "identifying an Internet service 
providej;" in the manner as claimed by appellant. 

Again, appeilant respectfijlly asserts that at least the third element of the prima facie case of 
obviousness has not been met, as noted above. 

Gmiip i6: Claim II 

With respect to Claim 11, the Examiner has relied on Col. 4, lines 36-67; Col. 5, lines 1-44; and 
Col. 8, lines 34-57 in Leeds to make a prior art showing of appellant's claimed "transmitting tht 
report to a central managed seivice provider configured to foward tlie report to the identified 
hosting authority." 

.A^ppeilant respectfully asserts that the orily meiuion of any sort of report in such excerpts from 
I..eeds simply teaches that 'addresses could be watched for incoming junk e-maii and a 
notitlcation from the authendcadon server could then be broadcast to users indicadng that mail 
with the subject of "XYZ" is junk e-maii' (see, specifically. Col. 8, lines 47-50), However, such 
notification sent to users does not meet appellant's claimed "traasmitting the report to a central 
TjnMgggd.. seryice prg^^^^ configured to forward the report to the identifigd^ h^^^^ 
(emphasis added), as ciaimed by appellant. Clearly, sending a notification to users, as in Leeds, 
fails to meet "transmitting the report to a central managed service provider" (emphasis added), in 
the manner as claimed by appellant. 

Again, appellant respectfully asserts that at least the third element of the prima facie cme of 
obviousness has not been met, as noted above. 

Group #7: Claim 12 

With respect to Claim 12, the Examiner has relied on Col. 5, lines 38-44 in Leeds to make a prior 
art showing of appellant's claimed technique including "at least temporarily saving the report 
and transmitting the report to the identified hosting authority at the end of a specified period." 
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AppeUaiU respectfully asserts that such excerpt only relates to "sending a verifkation 
message... wthin a period of time." Clearly, sending a yentlcMiQ».gMsa^ge to determine if a 
user is actually associated with the sender of e-mail does not meet appellant's claimed report let 
alone "transmitting the report to the identified hosting authority at the end of a specified period" 
(emphasis added), as claimed by appellant. 

Again, appellant respecttlilly asserts that at least the third element of the prima facie case of 
obviousness has not been met, as noted above. 

Group fi-8: Claim 16 

With respect to Claim 16, the Examiner has relied on Col. 3, lines 54-67; Col. 4, lines 1-23 and 
60-67; and Col, 5, lines 1-44 in Leeds to make a prior art showing of appellant's claimed 
technique "'wherein the hosting authority is an Internet service provider." 

.Appellant respectfully asserts that the excerpts from l .eeds relied upon by the Examiner mereiy 
disclose that 'a first level check is to determine if the alleged sender identified by the " From . " or 
" EepJy.-To :" fields are valid ' (emphasis added). In addition, Leeds discloses 'using the UNIX 
"whois" command to determine if a site..Cgi'..h (emphasis added). 

Clearly, using whois to perform a first level check to ensure the host actually exists for the 
alleged sender in the "From;" or *'Reply-To;" fields, as in Leeds, fails to even suggest a 
technique "wherein the hosting authority is an Internet serx'ice provider'' (emphasis added), as 
claimed by appellani. Appellant respectfully asserts thai niojeh cnsurni<i that a bcist actually 
exMs falls to specitlcally suggest a "hosting authority [thatj is an Imeinei sejvice provider as 
claimed by appellant. 

.Again, appellant respectfully asserts that at least the third element of the prima facie case of 
obviousness has not been met, as noted above. 

Group Ciaim 19 
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Wjth respect to Claim 19, the Exarniner has relied on Col. 4, lines 36-67; Col, 5, lines 1-44; and 
CoL S, lines 34-57 in i,eeds to make a prior art showing of appellant's claimed technique 
"wherein the processor is configured to transmit the report to a centra! managed service 
provider." 

Appeilfiut lespectiiilh assjt."Ui. th.it ihe onl\ mention ()ran\ son tif reporL m Mich c\cei(Hs liuin 
Leeds sunph teaches that 'addresses could be watched fo! mctmnny junk e-niai! and a 
notification from the autlicntication sei"ver could tlicn be broadcast to users mdicatmg that mail 
with the subject of "XYZ" is junk e-mail' (see, specifically. Col. 8, lines 47-50). However, such 
notification sent to users does not meet appellant's claimed *'transmit[ting] the report to a cmtrsi 
managed service provider" (emphasis added), as claimed by appellant. Cleai'ly, sending a 
notification to users, as in Leeds, fails to meet "transmttfting] the report to a central managed 
sendee provider'' (emphasis added), in the manner as claimed by appellant. 

Again, appellant respectfully avsserts that at least the third element of the prima facie case of 
obviousness has not been met, as noted above. 

Group iUi): Ciaim 20 

With respect to Claim 20, the Examiner has relied on Col. 4, iines 57-67; Col. 5, lines 1-8; and 
Col. 5, lines 50-67 in Aronson to make a prior art showing of appellant's claimed "database 
containing search teims used to identity the network address within text of the electronic 
message." 

After careful review of the excerpts relied on by the Examiner, appellant notes that ,4ronson 
merely discloses that "[i]f the network address contained in the source header is identified as the 
network address of a known spammer, a mle will be established to filter all incoming e-mail 
from this network address ilMJ&e^spanfiLStomgejje^ 230" (Col. 4, lines 60-62 -■ emphasis 
added). Further, Aronson discloses that "[rjules 210 based on keywords in the subject or body of 
spam e-mail may also be established" and '[fjor example, all e-mails containing the two words 
"sex" and "free" may be Mentif!M..a.s.spam an (Col. 4, lines 2-5 - emphasis added). In 

addition, .Aronson discloses that ''[ojther contemplated Edg bMdljng tllter^m^^ 



-21 - 



mail based on; (1) word or letter frequency analysis; (2) IP source frequency analysis; (3) 
misspelling analysis (unwanted e-mail often contains misspelled words); (4) word or letter 
combination analysis; (5) technical or legal RFC832 header coraplsance; and (6) feature 
extraction & analysis (e.g., based on phone numbers, URL's, addresses, etc.)" (Co!. 5, lines 58- 
64 - emphasis added). 

However, .Aronson's mere disclosure that the network address contained within the source 
header is used by a rule to filter e-mail from this network address to a spam storage area simply 
fails to even suggest that "a database^cwitai^^ [is] used to identi^thejietwork 

.address within text of the electronic message" (emphasis added), in the manner claimed by 
appellant Further, disclosing identifying and fdtenng spam based on keywords in the subject or 
body, as in Aronson, fails to suggest that "a database containing search terms [is] used to identify 
thoi§twork„y4re^^^^^ within text of tlie electronic message" (emphasis added), as claimed by 
appellant. In addition, ..A.ronsoii;s disclosure that rule handling tlher modules will filter e-mail 
based on IP source .frequency analysis, and featiire extraciion & analysis simply fails to suggest 
that "a dat^ase^cooMoii)g.^s^^^^^ [is] used to identiry. th^ within text of 

the electronic message" (emphasis added), as claimed by appellant. Clearly, identifying and 
filtering spam based on keywords and features, as in Aronson, fails to meet "a database 
containing search terms used to idenlitx the.M^ (emphasis added), in the manner 

as claimed by appellant. 

Again, appellant respectfully asserts that at least the third element of the prima fade case of 
obviousness has not been met, as noted above. 

Group Ml J: Claim 2 J 

With respect to Claim 21, the Examiner has relied on Col. 4, lines 57-67; Col. 5, lines 1-8; and 
Col. 5, lines 50-67 in Aronson to make a prior art showing of appellant's claimed "database 
containing a list of trusted network addresses." 

After careful review of the excerpts relied on by the Examiner, appellant notes that Aronson 
merely discloses that "[i]f the network MdrM^ is identified as the 
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network address of a known spammer, a rule will be established to filter all incoming e-mail 
from this network address into .the spam^ 230" (Col. 4, lines 60-62 ™ emphasis 

added). However, appellant respectfiilly asserts that Aronson's disclosure of filtering e-mail as 
spam based on the source address being identified as a known spammer simply fails to even 
suggest '^i.cUi.tabase containing a list of trusted network addresses " (emphasis added), as claimed 
by appelhinl Clearly, a source address of a known spammer, as in Aronson, simply fails to 
suggest " a li^t of trosted nehyork add^ (emphasis added), in the manner as claimed by 
appellant. 

Again, appellant respectfuHy asserts that at least the third element of tlie prima Jacie case of 
obviousness has not been met, as noted above. 

Group if ! 2: Claims 22 and 23 

With respect, to independent Claim 22, the Examiner has relied on Col 4, lines .51-56; Col. 5, 
lines 50-67, and the Abstract in .Aronson along with Col. 3, lines 54-67; and Col. 4, lines 1-35 in 
Leeds to make a prior art showing of appellant's claimed "code that identifies an authority 
hosting the network address." 

Appellant respectfully asserts that the excerpts from Leeds relied on by the Examiner only relate 
to a host com puter associated with a sender of an electronic mail message (see Abstract and Col, 
4, lines 66-67, specifically). In addition, Leeds discloses that "if a message has purportedly been 
relayed through a machine named mail.frotn nowhere, com and the mail liandhng system has 
determined that such a machine does not actually exist, the confidence rating for the message 
should be increased." Cleady, determining a host computenliost name of a sender of e-mail or 
relay, as in Leeds, does not meet appellant's specific claim language, namely an '•' authority 
hosting the network address" (emphasis added), as claimed by appellant. 

Further, appellant respectfully asserts that the excerpts from Aronson relied upon by the 
Examiner merely disclose that "[o]ther contemplated rule handling filter modules will filter e- 
.njsi! based on: (1) word or letter frequency analysis; (2) .rP..Murce..jTequenc^^ (3) 
misspelling analysis (unwanted e-mail ofim contains misspelled words); (4) word or letter 
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combsnation analysis; (5) technical or legal RFC822 header compliance; and (6) feature 
extraction & jjB (emphasis added) 

Clearly, flitering e-raai! based on IP source frequeflcy and feature extraction & analysis fails to 
even suggest "identify[yingl an authority hosting the network address" (emphasis added), as 
claimed by appellant. 

In addition, the Examiner argued that "Af[o]nson disclosed that the source header data from an 
incoming e-mail address (aardvark@aol .com) is analyzed by the spam probes," Further, the 
Examiner ar^ied that '[t]he source header data lacludes the ISP (in this case "aol") hostiag the 
spammer's network address (see col4, lines 45-67).' Appellant disagrees and respectfully 
asserts that the excerpt from .%onson simply discloses that "[a] spam probe is an e-mail address 
selected to make its way onto as many spam mailing lists as possible." Aronson continues, 
teas^hmii that filt \i> dho selected to appear hmh up on s-pammcrs' hsts m order to iecci\e spam 
!iiuhiiL,s t. \t\\ in fiiL madmg proc<^ss i n« (. n^il iddicss sikH js iu ^ i >l o"!^ 
{.kvirK ih<. nuft disd^>sui(_ ot tMtii, dn e-mail addicss m a spam piobc, as in Aumson 
compieteK laiK to e\en suggest identiH[vmg] an authority hostmg the network address 
(emphasis added), as claimed by appellant. 

Still with respect to independent Claim 22, the Examiner has again relied on the Abstract; Col. 3, 
lines 54-67; and Col. 4, lines 1-35 in Leeds to make a prior art showing of appellant's claimed 
"code that generates a report containing the identified network address." 

AppeHant respectfuHy asserts that the only suggestion of a ''report" in the exceipis rehed on by 
the Examiner merely relates to "'seed addresses [which] caii alert an e-raai! pfovider to potential 
mass mailings by reporting when mail is received for ghost or Jion-existent accounts." Cleariy, 
alerting an e-mail provider when an e-mail is received for a seed address, as in Leeds, fails to 
even suggest "generat[ing] a report containing the identified network address" (emphasis added), 
as claimed by appellant. 

Further, tlie Examiner argued that "Leeds also describes the similar process of identifying the 
host name of the spammer's address (please see col.4, lines 60-67 & col. 5, lines 1-45)." 
.Appellant disagrees and respectfully asserts that I-eeds simply discloses that '[tjhe fields for 
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"Rctinn Path 'Trom and "Repl>-To " arc hjghhghtcd &i> three ol the tloids which the piC!>eiit 
mventum v^ill pajse Aom the message headet As an example, [eeds teaches thai 'Ttoni 

48^>4l40>''rtnotneaL<.ldit.s^. com is bioken doun into a user jd <48941493) and a hostjname 
ftivn-ajcaiciddiess („!>m) t emphasis uidcd) ! ceds continuci disclosing that afirst !e\cl cbetk is 
justd] to detLtnitne ti iht a!kj;ed render idcntiiled In the Fiom oi Reph IjlUs aje 
\(ihd \joreo\ei I etds dischises that the t1ist lexel check iiKiud[e ] { \) scikiii^^. a message to 
die usei uientd'ieti b\ the I lom " Of "ilepK - 1 o fields and evirauiine tthetha the message can 
be &ucce!>i>tullv dch\eied, (2) U!>ing the L NIX " \\hois> command to determmc if a !>itc (oi hoi.t) 
by that name actually exists, (3) using the UNIX "fijnge[" command to identify if a user name 
exists at a verifiable host, (4) using the "yffy." command when connected to a sendmaii daemon 
to verify that a user exists at a particular site, and (5) using the UNLX " traceroute " command to 
make sure there is a valid route back to the specified host' (emphasis added). Clearly, 
performing a first level check including using whois, aiid traceroute to verify the host name from 
the "From:" and '^Reply-To:" fields, as in [.eeds, iails to even suggest ' generatfing] a report 
containing the itjenlified netw^^^ (emphasis added), as claimed by appellant. 

Fiirther, with respect to independent Claim 22, the Examiner has relied on Col. 4, lines 60-67; 
Col. 5, lines 1-44; and Col, 6, lines 52-65 in Leeds to make a prior art showing of appellant's 
claimed technique "wherein identifying the hosting authority comprises identifying an owner of 
a network domain." 

.Appellant respectfully asserts that the excerpts from Leeds relied upon by the Examiner merely 
disclose 'a ni.st. jeve! che^^^ is to deternune if the alleged sender identifjed by the 'Ir'rom." oi' 
^Reply-To;" fields are yajid" (emphasis added). \u addition. Leeds discloses "using the UNIX 
"whois" command to determine if a site tor host) by that nanii.- aetualiy exists' (emphasis added). 
Clearly, using whois to perform a fust level check to ensure the host actually e.Kists for the 
alleged sender in the "From:" or *'Reply-To:" fields, as in Leeds, fails to even suggest a 
technique "wherein identifying the hosting authority comprises identifying an owner of a 
network domain" (emphasis added), as claimed by appellant. Appellant respectfully asserts that 
merely ensuring that a host actually exists fails to even suggest "identifying an owner of a 
network domain," as claimed by appellant. 
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Again, appeljaiit respectfully asserts that at least the third element of the prima facie case of 
obviousness has not been met, as noted above. 

Gnmp iyJ3: Claim 25 

With respect to Claim 25, the E;xamiiier has relied on Vo\ 4, inies 57-6", C\>i ^ itnes t-8, and 
Col. 5, lines 50-67 in Aronsoji to make a prior art showmu of appellant's claimed \uUe thai 
compares text within the electronic message to a database of words to locate tlic network address 
within the text." 

After careful review of the excerpts relied on by tlie Exaininer, appellant notes that Aronson 
merely discloses that "[i]f the network address con tained in the source header is identified as the 
nctxsork address of a kno\\n ispammcr a lulc wdl be established to tlltei all uKoming e-mail 
Uom this iKiwoik <kidiess tnio the spam st(.' sa<'». .rea '^M) ffol \ Iiuls (m o'^ i,iii|>insis 
added) Furthet \fonson JiS(.U>ses that ' |t|ulL.s it^std on ke\ ords in t he siitvi<.t.f ii! [jikK of 
spam e-mail ma\ a!so tie osfahiisiicd and jtloj example ail e-mails containing the x\so words 
"sex" and "free** may be identified as spam and filtered ' (Col. 4, lines 2-5 - emphasis added). In 
addition, Aronson discloses that "[ojtber contemplated mle handling^ fi^^^ 
tnall based on: (1) word or letter frequency analysis; (2) IP...source f^^^^ (3) 
misspeiiing analysis (unwanted e-mail often contains misspelled words); (4) word or letter 
combination analysis; (5) technical or legal RFC822 header compliance; and (6) feature 
extmMjQn & analysis (e.g., based on phone numbers, URLk Mdmsses , etc.)'' (Col, 5, lines 58- 
64 ~ emphasis added). 

However, the mere disclosure th&i the network address contained withiii the source header is 
used by a rule to filter e-mail from this aetwork address to a spam storage area, as in Aronson, 
simply fails to even suggest "code that compares text within the electronic message to a database 
ofwOT^ to locate the oMwoitjicyresod^i^^ (emphasis added), in the maimer claimed 
by appellant. Further, Aronson's disclosure to identify and filter spam based on keywords in the 
subject or body fails to suggest "code that compares text within the electronic message to a 
.database.M.W)ids to locate, the .network.addr^^^^ (emphasis added), as claimed by 

appellant. In addition, Aronson's disclosure that rule handling filter modules will filter e-mail. 
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based on IP source frequency analysis, and feature extraction Sc analysis simply fails to suggest 
"code that compares text within the electronic message to a database of words to jocate the 
network M4ress >yith^ (emphasis added), as claimed by appellant. Clearly, identifying 

and filtering spam based on keywords and features, as in Aronson, fails to meet "a database of 
words to locate the network address within the texf (emphasis added), in the manner as claimed 
by appeiiant. 

Again, appellajit respectfully asserts that at least the third element of the prima facie case of 
obviousness has not been met, as noted above. 

Group Clam 26 

Witli respect to Claim 26, the Examiner has relied on Col. 4, lines 57-67; Col. 5, lines 1-8; and 
Col. 5, Hnes 50-67 in Aronson to make a prior art showing of appellant's claimed "code that 
compares the identifred network address with trusted network addresses." 

After careful review of the excerpts relied on by the Examiner, appellant notes that Aronson 

merely discloses that "[i]f the netwQrkMdreM Contaj^^^^ is identified as the 

network address of a known spammer, a mie will be established to fi.lM".ajLi.«^^^^ 

from this network address into the spam storage area 230" (Col. 4, lines 60-62 ■■■ emphasis 

added). 

However, appellant respectfully asserts that .Aronson's disclosure of filtering e-niai! as spam 
based on the source address being identified as a known spammer simply fails to even suggest 
"code that compares the identified network address with taisted network addresses" (emphasis 
added), as claimed by appellant. Clearly, the source address of a known spanuner , as in 
.Aronson, simply fails to suggest " trusted network addresses" (emphasis added), in the manner as 
claimed by appellant. 

Again, appellant respectftilly asserts that at least the third element of the prima facie case of 
obviousness has not beeri met, as noted above. 
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Grovp M13: Claim 29 

With respect to Claim 29, the Examiner has relied on Col. 4, lines 37-67; ajid Col. 5, lines 1-44 
in Leeds to make a prior art showing of appeiiant's claimed technique '"wherein the report is 
utilized to generate an electronic mail message to be sent to the identified organization." 

Appellant respectfully asserts tliat Leeds merely discloses "automatically sending a reply (In the 
form of a verification request) to the pur ported $ender( s)" (Col. 4, lines 38-40 ~ emphasis added). 
Further, Leeds discloses 'issuing a verificaaaus^uest and can be in many forms, including: (I) 
.SMdin^.a..mesMS?...to..the...u^^^^^ identified by the "From:" or "Reply-To;" fields and examining 
whether the message can be successfully delivered' (Col. 5, lines 20-23 ••• emphasis added). 
However, such verification request message sent to users fails to meet a technique ''wherein the 
.report is iitiljze^^^ to generate an electronic mail message to be sent to the identified organization" 
(emphasis added), as claimed by appellant. Clearly, sendisig a veritlcation message to the 
py:VffOrted sento^ as in I-eedvS, fails to meet '"an electronic mail message to be sent to Ifie 
]Ms^^J^SM^^:!^^ (emphasis added), in the manner as claimed by appellant, 

Again, appellant respectfully asserts that at least the third element of the prima facie case of 
obviousness has not been met, as noted above. 

Group iH6: Claim 30 

With respect to Claim 30, the Elxaminer has relied on Col. 4, lines 36-67; and Col. 5, lines 1-44 
in Leeds to make a prior art showing of appellant's claimed technique "wherein identifying the 
URL turther comprises examining text surrounding the URL to determine a likelihood that tite 
URL is an address of a web site associated with unsolicited messages." 

Appeilajvt respectfully asserts that Leeds merely discloses that ''previously read junk e-mail can 
added to the rules base to look for certain phrases" and that "[t]his may not be sufficient, 
however, to screen out valid mail that cites or quotes from the junk e-mail," (Col. 4, lines 52-56 
- emphasis added). Further, Leeds discloses that "[i]f, however, the content is combined with an 
address that cannot pass a verification request, the user may wish to assign a 100% confidence 
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rating, and the mail can optionaiiy be automatically deleted" (Col. 4, lines 56-59). However, the 
mere disclosure of looking for certain phrases, as in I.eeds, simply fails to even suggest a 
technique "wherein identifying the URL further comprises examining text sffrrft utiding the J^JllL 
to determine a likelihood tliat the URL is an address of a web site associated with unsolicited 

messages" (emphasis added), as claimed by appellant CHearly, looking for certain phrases fails 
to specifically suggest "examining test surrounding the URL" (emphasis added), in the manner 
as claimed by appellant. 

Again, appellant respect&ily asserts that at least the third element of the prima facie case of 
obviousness has not been met, as noted above. 

GmupiJ?: Claim 31 

With respect to Claim 31, the Exaniine? has relied on Col. 4, lines 36-67; and C'ol 5, lines 1-44 
in Leeds to make a prior art showing of appellant's claimed technique "wherein the report 
includes disclaimer information and user definable text," 

Appellant respectfully asserts that Leeds merely discloses "automatically sending a reply (in the 
fonn of a yCTfigMQ» reau to the purported sM^ef^ ^^^^^ (Col . 4, lines 38-40 - emphasis added). 
Further, Leeds discloses issuing a verification request and can be in many forms, including: (I ) 
sending a message to the user identified by the "From;" or "Reply-To;" fields and examining 
whether the message can be siiccessfullv dehvcrcd" (Col ^, hncs 20-2 - emphasis added^ 
Ho^vcvei suth xeniKitKin lequeM nKbN,sgL seiu o j-^ers as m I llJs }<)iK U) e\tii sus^^esi a 
technique \shereu) ihe apou uKh dc<. d r ! tcmat v>n and uso detunbk tCst <emphaMs 
added) as claimed h\ appellap (. kfK no p-^ere l s^ osu t of a scnfKation Kgiicst taiis to 
suggest disclannci niloinidtion and usoi definable tc\t (cnjphasis added) m Ihe niannc? as 
claimed by appellant. 

Again, appellant respectfully asserts that at least tlte third element of the prima facie case of 
obviousness has not been met, as noted above. 



-29- 



In view of the remarks set forth hereinabove, all of the independent claims are deemed 
allowable, along wUh amy claims depending therefrom. 
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VIII CLAIMS APPENDIX (37 C.F.R. § 41.37(c)(l)(vi{t» 

The text of the claims involved in the appeal (along with associated status infofmation) is set 
forth below: 

1 . (Previousiy Presented ) A inethod for generating a report on m unsoiiciied eieclroiTic 
message, comprising; 

receiving ail electronic mail message; 

determining whether the eiectronic message is an unsolicited message; 
if the message is an unsolicited message, 

examining the message to identify a network address relating to tlie 
message, 

identifying an authority hosting the network address, and 
generating a report containing the identified network address and 
hosting authority; 

wherein identifying the hosting authority comprises identifying an owner of a network 
domain. 

2. (Original) The method of claim 1 further comprising transmitting the generated report 
to the identified hosting authority. 

3. (Original) The method of claim 1 wherein examining the message to identify a 
network address comprises identifying a URI-. 

4. (Original) The method of claim 3 wherein identifying a URL comprises comparing text 
within the electronic message to a database of words to identify the URL. 

5. (Original) The method of claim 3 further comprising comparing the identified URL to 
a dataiiase of legitimate URLs. 

6. (OriginaJ) The method of claim 5 further comprising updating the database based on 
electronic messages received. 
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7. (OriginaJ) The method of claim 3 wherein identifying the hosting authoiity comprises 
utiiizing an Internet too! to iocate a web server hosting the URL. 

8. (OriginaJ) The method of claim 7 wherein utilizing an Internet tool cxmiprises utiiizing 

weois, 

9. (Cancelled) 

10. (Original) The method of claim i wherein identifying the hosting authority comprises 
identifying an Internet service provider. 

1 1 . (Original) The metliod of claim 1 fiirther comprising transmitting the report to a 
central managed service provider configured to forward the report to the identified hosting 
authority. 

12. (Original) The method of claim l further comprising at least temporarily saving the 
report and transmitting the report to the identified hosting authority at the end of a specified 
period. 

13. (Previously Presented) A system for generating a report on an unsolicited electronic 
message, the system comprising: 

a detector operable to detect a network address within an electronic message identified as 
an unsolicited message; 

a host identifier operable to identify an authority hosting the network address; 

a report generator operable to generate a report containing the identified network address 
and hosting authority; and 

a storage medium configured to at least lemporarily store the identified network address 
and hosting authority; 

wherein identifying the hosting authority comprises identifying an owner of a network 
domain. 
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14. (Original) The system of claiiii 13 ftirther comprising a detector operable to detect 
imsoiicited tnessages. 

15. (Origina!) The system of claim 13 wiierein the network address is a URL. 

16. (Original) The system of claim 13 wherein the hosting authority is an Internet service 
provider. 

17. (Original) The system of claim 13 further comprising a processor operable to transmit 
the generated report 

18. (Original) The system of claim 17 wherein the processor is configured to transmit the 
report to the identified hosting authority'. 

19. (Original) The system of claim 17 wherein the processor is configured to transmit the 
report to a centi'al managed ser\'ice provider. 

20. (Original) The system of claim 13 ftjrther comprising a database containing search 
terms used to identify the network address witliin text of tlie electronic message. 

21 . (Original) The system of claim 13 further comprising a database containing a list of 
trusted netxvork addresses. 

22. (Previously Presented) A computer product for generating a repo.rt on a.n unsolicited 
electronic message, comprising: 

code that receives an electronic mail message; 

code that determines whether the electronic message is an unsolicited message; 
code tliat examines tlie message to identify a network address relating to the message if 
the message is m unsolicited message, 

code that identifies an authority hosting the network address; 

code that generates a report containing the identified network address; and 

a computer readable medium that stores said computer codes; 
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wherein identifying the hosting authority comprises ideRtifying an owier of a network 
domain. 

23. (Origina!) The computer product of claim 22 wherein the computer readable medium 
is selected from the group consisting of CD-ROM, floppy disk, tape, flash tnemoi^, system 
memory, hard drive, and a data signal embodied in a carrier wavt. 

24. (Original) The computer product of claim 22 further comprising code that transmits 
the generated report to the identified hosting authority. 

25. (Original) The computer product of claim 22 further comprising code that compares 
text within the electronic message to a database of words to locate the network address within the 
text. 

26. (Original) The computer product of claim 22 further comprising code that compares 
the identified network address with trusted network addresses. 

27. (Previously Presented) The method of claim 1 wherein identifying the hosting 
authority further comprises identifying an address, an administrative contact name, an 
administrative contact telephone number, and a name of at least one server associated with the 
hosting authority. 

28. (Previously Presented) The method of claim i wherein identifying the liosting 
authority further comprises identifying an organization to which the network domain is 
registered. 

29. (Previously Presented) The method of claim 28 wherein the report is utilized to 
generate an electronic mail message to be sent to the identified organi^:ation. 

30. (Previously Presented) TIte method of claim 4, wherein identifying the URL ftrrther 
comprises examining text surrounding the IML to determine a likelihood that the URL is an 
address of a web site associated with unsolicited messages. 
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31, (Previously Presented) The method of claim I wherein the report includes 4isd 
information and user definable text. 



IX EVIDENCE APPENDIX (37 C.F.R. § 4i.37(c)(l)(ix)) 

There is no such evidence. 
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X RELATED PROCEEDING APPENDIX (37 C.F.R. § 41.37(c)(l)(x)) 



N/A 
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In the event a telephone conversation would expedite the prosecution of this applicatjon, the 
Examiner may reach the undersigned at (408) 971.-2573. For payment of any addUional fees due 
in connection witii the filing of this paper, the Commissioner is auUiorixed to charge such fees to 
Deposit .Account No. 50-1351 (Order No. NAIiP314). 



Respectful ly siibiniited. 



gy /KEViNZiLKA/ q^^^. March 8, 2007 

Kevin J. Zilka 
Reg. No. 41,420 

Ziika-Kotab, P.C. 

P.O. Box 72 1 i 20 

San Jose, California 95172-1120 

Telephone: (408)971-2573 

Facsimile. (408) 971-4660 
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The Appeal Brief filed on 11 December 2006 is defective for failure to comply with one or more provisions of 37 CFR 

41.37. 

To avoid dismissal of the aj^eal, applicant must file anamended brief or other appropriate correctton (see MPEP 
1205.03) within ONE MONTH or THIRTY DAYS from the maifing.date of this Notification, wlitchever is longer, 
EXTENSIONS OF THIS TIME PERIOD MAY BE GRANTED UNDER 37 CFR 1.t36. 

1 . □ The brief does not contain the items required under 37 CFR 41 .37(c}, or ttie items are not under the proper 

heading or in the proper order. 

2. □ The brief does not contein a statement of the status ofalf claims, (e.g., rejected, allowed, withdrawn, otjjected to, 

cancseied), or does not identify the appealed claims {37 CFR 4i .37{cK1Kiii)). 

3. □ At ieast one amendment has been filed subsequent to the finai rejection, and the brief does not contain a 

statement of the status of each such amendment (37 CFR 41 .37(c)(1 )(tv)). 



4. iSl (a) The brief does not contain a concise explanation of the subject matter defined in each of the independent 

claims involved in the appeal, refetring to the specification by page and line number and to the drawings, if any, 
by reference characters; and/or (b) the brief fails to: (1) identify, for each independent claim involved in the 
appeal and for each dependent ciaim argued separately, every means plus function and step plus function under 
35 U.S.G. 112. sixth paragraph, and/or (2) set forth the structure, material, or acts described in the specification 
as coiresponding to each claimed function with reference to the specification by page and fine number, and to 
the drawings, if any. by reference characters (37 CFR 4 1 .37(cK1)(v)). 

5. O The brief does not contain a concise statement of each ground of rejection presented for review (37 CFR 

41.37{cK1)(vi)} 

6. O The brief does not present an argument under a separate heading for each ground of rejection on appeal (37 CFR 

41.37{cK1)(vii)). 

7. O The brief does not contain a correct copy of the appealed claims as an appendix thereto (37 CFR 

41,37{cK1}(vtii)), 

8. □ The brief does not contain copies of the evidence submitted under 37 CFR 1 , 130, 1 . 1 31 , orl . 1 32 or of any 

other evidence entered by the examiner and relied upon by appellant in fite appeal, along with a 
statement setting forth where in the record that evidence was entered by the examiner, as an appendix 

, thereto {37 CFR 41 ,37(cK1)(tx)), 

9. □ The brief does not contain copies of ttie decisions rendered by a court or ttie Board in the proceeding 

identified in the Related Appeals and Interferences section of the brief as an appendix thereto (37 CFR 

41.37(c)(1Kx)). 

1 0. ^ Other (including any explanation in support of ttie above items): 

'Nummary ofcfairm d subfact matt^f ngf fsgnt^in tffi^fpxpm^tionpf any dependent claim aruaed sepa^fe/y a 
reautrsd by (37 CF R 41.37/c Ulimi Apaiicantis encouraged to verify that me appeal Mgffe h comBlmncf with the 
fsquirements sSpylat^d in ttte MPBe. 
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